BUG/MEDIUM: qmux: Close connection on invalid frame

In qcc_qmux_recv(), when calling qmux_parse_frm(), also treat negative
values as an error, and close the connexion. qmux_parse_frm() will
return -1 if the frame is of an invalid type, and we don't want to
process any further, or we will crash.

diff --git a/src/qcm_qmux.c b/src/qcm_qmux.c
index aa2cb6a91b06920bb4694249d30e416a780c65eb..4491fb72692feab532f9f78e5e4726c09a02d11c 100644 (file)
--- a/src/qcm_qmux.c
+++ b/src/qcm_qmux.c
@@ -195,7 +195,7 @@ int qcc_qmux_recv(struct qcc *qcc)
                        buf_rec = b_make(b_orig(buf), b_size(buf),
                                         b_head_ofs(buf), qcc->rx.rlen);
                        frm_ret = qmux_parse_frm(qcc, &buf_rec);
-                       if (!frm_ret) {
+                       if (frm_ret <= 0) {
                                /* TODO implement proper connection closure */
                                conn->flags |= CO_FL_ERROR;
                                goto out;